Route reflection, with ourselves as next hop

A route learned from one router of our AS went to no other (RFC 4271
§9.2.1), so every router needed a session with every other. A router at
the end of a single link, with one session to its neighbour inside the AS,
heard only of what that neighbour learned itself, and nothing of what the
neighbour had from the routers behind it.

A peer in our own AS can now be made a route reflector client
(`route_reflector_client`, RFC 4456). What a client sends goes to all our
routers; what the others send goes to the clients. A reflected route gets
ORIGINATOR_ID (where it started, if it does not say) and our cluster ID at
the front of CLUSTER_LIST; it is not sent back to the router it started
at, nor round to a cluster it has been through, and one that comes back
anyway is refused as "route reflected back to us". The cluster ID is the
router ID unless `cluster_id` says otherwise. The two attributes are now
decoded as such rather than kept as bytes, and are never sent to other
networks.

Unlike a standard reflector, this one is the next hop of what it reflects,
as it is of everything it announces: there is no resolving a next hop
that is not a neighbour, so a client reaches what lies behind another
router through the reflector.

Only peers in our own AS can be clients; the configuration refuses the
setting for any other. Nothing changes in what other networks are told:
Only to Customer marks go along with reflected routes, and every
receiving session keeps its own max_prefixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/content/docs/getting-started/introduction.md

@@ -61,8 +61,8 @@ Ferrix provides the following capabilities:
 
 Ferrix 0.2.2 does not support the following features:
 
-- Route reflection, per-client best path selection for route servers, and
-  ADD-PATH for advertised routes.
+- Per-client best path selection for route servers, and ADD-PATH for
+  advertised routes.
 - TCP Authentication Option (TCP-AO), TCP MD5 signatures, and the
   Generalized TTL Security Mechanism (GTSM).
 - Long-Lived Graceful Restart, Bidirectional Forwarding Detection (BFD),

docs/content/docs/guides/passing-routes-on.md

@@ -49,8 +49,8 @@ rules cannot be disabled:
 
 - To the neighbor from which the route was received.
 - To a neighbor whose AS number is in the AS path of the route.
-- From one IBGP neighbor to another IBGP neighbor. Route reflection is not
-  supported.
+- From one IBGP neighbor to another IBGP neighbor, unless one of them is a
+  route reflector client. See [Route Reflection](#route-reflection).
 - To an EBGP neighbor, if the route has the `NO_EXPORT` community; to any
   neighbor, if the route has the `NO_ADVERTISE` community.
 
@@ -63,6 +63,7 @@ each type of neighbor.
 |---|---|---|---|---|
 | EBGP | Local AS prepended | Local address of the session | Removed | Not sent |
 | IBGP | Unchanged | Local address of the session | Unchanged | Sent; 100 if the route has none |
+| IBGP, reflected | Unchanged | Local address of the session | Unchanged | Sent unchanged |
 | `ROUTE_SERVER_CLIENT` (RFC 7947) | Unchanged | Unchanged, if the client can use it | Unchanged | Not sent |
 
 Ferrix advertises unknown optional transitive attributes with the Partial
@@ -256,6 +257,65 @@ routes and Ferrix advertises them to a second neighbor, the second neighbor
 receives all routes after 2.1 seconds, with an average of four routes in
 each UPDATE message.
 
+## Route Reflection
+
+By default, Ferrix does not advertise a route learned from an IBGP
+neighbor to another IBGP neighbor (RFC 4271). Every router of the local AS
+then requires an IBGP session with every other router. Route reflection
+(RFC 4456) removes that requirement: a router that is a route reflector
+advertises routes between its IBGP neighbors.
+
+To make an IBGP neighbor a route reflector client, configure the following
+statements:
+
+```textproto
+peers {
+  name: "router-3"
+  remote_asn: 64500
+  route_reflector_client: true
+  export { learned_routes: true }
+}
+```
+
+Ferrix then advertises routes as follows:
+
+- Routes from a client go to all IBGP neighbors, clients and others.
+- Routes from an IBGP neighbor that is not a client go to the clients
+  only.
+- Routes from EBGP neighbors go to all IBGP neighbors, as without route
+  reflection.
+
+The export policy of the receiving neighbor must enable `learned_routes`.
+`route_reflector_client` is permitted only for IBGP neighbors; Ferrix
+rejects the configuration otherwise. Advertisement to EBGP neighbors is
+not affected.
+
+### Next Hop of Reflected Routes
+
+Ferrix advertises a reflected route with the local address of the session
+as next hop, as it does every route. A standard route reflector does not
+change the next hop. Ferrix does, because it does not resolve next hops
+that are not directly connected: a client that is not connected to the
+router that learned the route can then still use it, and sends the
+traffic through the route reflector.
+
+### Loop Prevention
+
+When Ferrix reflects a route, it adds the ORIGINATOR_ID attribute, which
+contains the BGP identifier of the router that learned the route, if the
+route does not already have it. It also prepends its cluster ID to the
+CLUSTER_LIST attribute. Ferrix does not reflect a route back to the router
+in its ORIGINATOR_ID, and does not reflect a route whose CLUSTER_LIST
+contains its cluster ID. Ferrix rejects a route from an IBGP neighbor
+whose ORIGINATOR_ID is the local router ID, or whose CLUSTER_LIST contains
+the local cluster ID, with the reason `route reflected back to us`.
+
+The cluster ID is the router ID by default. Configure the top-level
+`cluster_id` statement to give two route reflectors that serve the same
+clients the same cluster ID.
+
+Ferrix does not send ORIGINATOR_ID and CLUSTER_LIST to EBGP neighbors.
+
 ## Verifying Route Advertisement
 
 The metric `bgp_routes_exported_total{change}` counts learned routes that
@@ -269,6 +329,7 @@ display them, use the neighbor's own tools.
   client receives the same best path.
 - ADD-PATH is not supported for advertisement; only the best path is
   advertised.
-- Route reflection is not supported.
+- Best path selection does not use ORIGINATOR_ID and CLUSTER_LIST as tie
+  breakers (RFC 4456 Section 9).
 - UPDATE messages are generated separately for each session, even when
   several sessions receive identical routes.

docs/content/docs/reference/configuration.md

@@ -55,6 +55,7 @@ Top-level statements.
 | `kernel` <span class="type">[Kernel](#kernel)</span> | Disabled | Enables kernel route installation (Linux only). |
 | `export` <span class="type">[ExportPolicy](#exportpolicy)</span> | Originated routes only | Specifies the export policy for neighbors that have no `export` statement. |
 | `control_communities` <span class="type">bool</span> | `false` | Enables control communities, which restrict the neighbors to which a route is advertised and prepend the local AS number on its way to them. See [Control Communities](@/docs/guides/passing-routes-on.md#control-communities). |
+| `cluster_id` <span class="type">string</span> | `router_id` | Specifies the cluster ID that the router uses as a route reflector, as a dotted-quad IPv4 address. See [Route Reflection](@/docs/guides/passing-routes-on.md#route-reflection). |
 | `graceful_restart` <span class="type">[GracefulRestart](#gracefulrestart)</span> | Enabled | Specifies graceful restart for neighbors that have no `graceful_restart` statement. Its `restart_time_seconds` also limits how long Ferrix waits at startup for neighbors to send their routes. |
 
 ## Peer
@@ -75,6 +76,7 @@ Statements for a BGP neighbor.
 | `require_role` <span class="type">bool</span> | `false` | Rejects the session if the neighbor does not advertise a BGP role. Requires `role`. |
 | `export` <span class="type">[ExportPolicy](#exportpolicy)</span> | Top-level `export` | Specifies the export policy for the neighbor. Replaces the top-level `export` statement. |
 | `graceful_restart` <span class="type">[GracefulRestart](#gracefulrestart)</span> | Top-level `graceful_restart` | Specifies graceful restart for the neighbor. Each statement that is set replaces the corresponding top-level statement. |
+| `route_reflector_client` <span class="type">bool</span> | `false` | Makes the IBGP neighbor a route reflector client: Ferrix advertises to it the routes learned from other IBGP neighbors, and advertises its routes to them. Permitted only for IBGP neighbors. See [Route Reflection](@/docs/guides/passing-routes-on.md#route-reflection). |
 | `groups` <span class="type">uint32, repeated</span> | None | Specifies the groups of the session, by number, for control communities that name sessions by group. Use the same numbers on all routers in the local AS. Range: 1 through 4,294,967,295. See [Session Groups](@/docs/guides/passing-routes-on.md#session-groups). |
 
 ## TcpEndpoint

docs/content/docs/reference/rfcs.md

@@ -44,7 +44,7 @@ The base protocol specification.
 | §9 | Adj-RIB-In (per-peer table of received routes) | ✅ |
 | §9 | Locally originated routes, advertised to all established peers | ✅ |
 | §9 | Advertisement of the best path for each prefix to neighbors (`export.learned_routes`), with the local AS prepended and the local address as next hop; MED and LOCAL_PREF not sent to EBGP neighbors; LOCAL_PREF sent to IBGP neighbors (§5.1.4, §5.1.5, §9.1.3) | ✅ |
-| §9.2.1 | Routes learned from an IBGP neighbor not advertised to other IBGP neighbors (no route reflection) | ✅ |
+| §9.2.1 | Routes learned from an IBGP neighbor not advertised to other IBGP neighbors, except by route reflection (RFC 4456) | ✅ |
 | §9.1.3 | Routes not advertised to a neighbor whose AS is in the AS path | ✅ |
 | §5 | Unknown optional transitive attributes advertised with the Partial bit set; unknown non-transitive attributes not advertised | ✅ |
 | §9.2 | Hold timer reset on any received message (not only KEEPALIVE) | ✅ |
@@ -107,6 +107,18 @@ The base protocol specification.
 | End-of-RIB marker sent and received | ✅ |
 | Route selection deferred until neighbors' End-of-RIB (for the removal of kept kernel routes and End-of-RIB markers for learned routes) | ✅ |
 
+### RFC 4456 — BGP Route Reflection
+<https://datatracker.ietf.org/doc/html/rfc4456>
+
+| Feature | Status |
+|---|---|
+| Route reflector: routes from clients to all IBGP neighbors, from other IBGP neighbors to clients | ✅ |
+| ORIGINATOR_ID and CLUSTER_LIST added on reflection, not sent to EBGP neighbors | ✅ |
+| Routes with the local router ID as ORIGINATOR_ID, or the local cluster ID in CLUSTER_LIST, rejected | ✅ |
+| Configurable cluster ID | ✅ |
+| Next hop unchanged on reflection | ❌ The route reflector is the next hop: next hops that are not directly connected are not resolved |
+| ORIGINATOR_ID and CLUSTER_LIST length as best path tie breakers (§9) | ❌ |
+
 ### RFC 8538 — Notification Message Support for BGP Graceful Restart
 <https://datatracker.ietf.org/doc/html/rfc8538>